The present invention relates to telephone switching systems, and more particularly to systems and methods for analyzing and displaying switching-system-produced output streams containing information regarding the operation and internal state of the switching system.
Modern telephone switching systems are large-scale, highly complex systems incorporating one or more switching elements cooperatively controlled and supervised by suitable computing means. One commercial exemplar of a modern telephone switching system is the 5ESS(copyright) ELECTRONIC SWITCHING SYSTEM, a product of Lucent Technologies Inc., 600 Mountain Avenue, Murray Hill, N.J. 07974. The 5ESS electronic switch is a distributed switching system, in that the switching capabilities of the system may be distributed among a plurality of switching modules, and the control, supervision, and administration capabilities are distributed among a plurality of computing facilities operating in cooperation. The 5ESS electronic switch is described in The 5ESS Switching System, ATandT Technical Journal, Vol. 64, No. 6, Part 2 (July-August 1985). Each of the computing facilities in the 5ESS electronic switch includes appropriate computer programs to achieve the desired operation of the associated switching elements and other functional components of the switching system, and interconnecting transmission facilities, signaling systems, wired subscriber lines, and cellular service systems. These programs are extensive.
Although the 5ESS electronic switch is engineered to provide highly reliable service, problems do occur. Rapid recognition of the sources of new problems, and current levels of previously reported problems, are critical to understanding the current state of the switching system (or network thereof) so that prompt action can be taken to resolve such problems.
The 5ESS electronic switch provides a report data stream containing time-stamped information regarding the current state and recent operation of the switching system. The report data stream provides, among other functions, the primary means by which the activity of the switch may be communicated to persons responsible for ensuring proper operation of the switching system and for correcting any problems which may occur. Thus, the report data stream may be considered to be the xe2x80x9cvoice of the switch.xe2x80x9d
The report data stream includes:
a transcript of interactions between operating personnel and the switching system;
traffic reports, reports describing the state of switch hardware, reports of automatic actions taken by the switch, routine or scheduled diagnostic reports, other similar reports reflecting the routine operation of the switching system; and
reports of various types indicating non-routine events, abnormal conditions, errors, or other indications of trouble within the switching system.
Historically, the report data stream has been supplied via a standard interface, such as a serial port, to a xe2x80x9cread-onlyxe2x80x9d printer (xe2x80x9cROPxe2x80x9d). Accordingly, the report data stream is sometimes referred to using the acronym xe2x80x9cROPxe2x80x9d, and reports therefrom are referred to as xe2x80x9cROP reportsxe2x80x9d.
When a problem occurs, many possible reports or combinations of reports may be produced by the switching system. Analyzing the root cause of the problem requires identifying the xe2x80x9cback-tracexe2x80x9d or thread of reports that lead up to or result from the problem. However, the report data stream output is voluminous. For a typical 5ESS electronic switch in operation in a real-world application, the report data stream may comprise in excess of 15 000 individual messages and may be as large as 4 to 5 megabytes per day. Output of this volume, when produced on human-readable media, is difficult to use for problem identification. This difficulty is compounded because multiple switches are now often located in a single building or complex, and because service providers desire to manage large numbers of switches from centralized management centers. Accordingly, in modern practice, the report data stream from a switch is often recorded electronically (e.g., stored in a computer), rather than printed, and the report data streams from several switches are sometimes collected and recorded at a central location.
Persons needing to review the electronically stored report data stream output may use the resources of a computer, or other suitable means, which allow the user to search for and display reports of interest. It is generally easier to search and display the electronically stored report data stream output than it is to use report data stream output fixed in conventional media, such as paper. A system for collecting and recording report data stream output streams from several switching systems is commercially available from Lucent Technologies Inc. under the designations OMP and MFOS; and from ADC Telecommunications Inc., Winchester, Mass., under the designation METRICA.
Although the report data stream output may be stored, searched, and displayed electronically, it nonetheless remains difficult for persons examining the output to (a) understand the significance of a particular report instance; or (b) identify or select those report instances which may be important from among the large quantity of data collected. It is difficult to understand the significance of a particular report instancexe2x80x94that is, a reported eventxe2x80x94because, when viewed in isolation, there is no way for a person to determine the frequency of the event in a switch or the distribution of the event across diverse switch installations, locations and applications.
It is difficult to identify or select xe2x80x9cimportantxe2x80x9d report instances because doing so requires a determination of whether the report corresponds to a xe2x80x9cnewxe2x80x9d problem or a previously reported problem, and, if the latter, which previously reported problem.
Current methods of problem detection from the switch report data stream disadvantageously involve manual analysis of individual reports or small combinations of reports. Different events within the switch may be reported using the same reporting mechanism, and hence when reported may appear superficially to be the same or a related event. Thus, current methods require that personnel analyzing the report have extensive subject-matter expertise, and apply anecdotal knowledge regarding previously reported problems.
Moreover, events appear in the report data stream of each switch approximately in the sequence in which they occur, and the report data streams of the switches are separately maintained. Accordingly, there has been no way to establish and display meaningful correlations or patterns among reported events occurring in a single switch, events occurring in a group of related switches, events occurring in switches directed to the same application, and events occurring across the installed base of switches or releases of generic software.
Although the problems of the prior art are discussed above in the context of the report data stream produced by the 5ESS electronic switch, a particular commercial product, it is believed that users and manufacturers of other telephone switching systems may experience similar problems. It is believed that many other telephone switching systems, including those of other manufacturers, produce one or more data streams for reporting to network operators information regarding problems or abnormal events, although the format and content of the reports may differ.
The disadvantages of the prior art are overcome by a system and method according to the present invention for automatically analyzing and displaying switch report information. In accord with the invention, there is provided a system and methods for storing and retrieving of switch report data, reading and xe2x80x9cprocessingxe2x80x9d of the switch report data, organizing and storing the processed information, identifying and classifying patterns in the report data, further classifying patterns into unique problems, and viewing the resulting information.
According to an aspect of the invention, the system and/or associated method acquire switch report information from one or more switching systems and identify therefrom unique reports, patterns or classifications of reports, or problems indicated by such reports. According to another aspect of the invention, the system and/or associated method analyze switch report information to determine whether a report contained therein corresponds to or is equivalent to a report, pattern, or problem which has previously been identified. According to a further aspect of the invention, the system and/or associated method analyze switch report information from a plurality of switches to determine correlations among reports, patterns, or problems, and make available for display to the user switch report information including such correlations. Advantageously, the correlations may span time, space (that is, multiple switches, networks of switches, or other groupings of switches), application type, and software version.